Crypto’s $17B Oopsie: When Keys Go Rogue and Bridges Burn

by

Well, butter my biscuit and call me surprised-DefiLlama has tallied a whopping 518 crypto hacks over the past decade, totaling over $17 billion in losses. That’s enough to buy a small country, or at least a really nice yacht for every hacker involved. And what’s the latest trend in this grand larceny? Attackers are swapping their coding hats for key-stealing fedoras, targeting private keys, bridges, and wallets instead of just smart contracts. Case in point: rsETH just lost a cool $290 million. Ouch.

  • DefiLlama’s ledger of doom lists 518 crypto hacks in the last 10 years, with losses topping $17 billion. That’s a lot of avocado toast.
  • The bad guys are getting lazy-or smarter, depending on how you look at it. Instead of hunting for smart contract bugs, they’re just stealing keys and phishing like it’s 1999.
  • Kelp DAO’s rsETH bridge got hit for ~$290 million, making it the biggest DeFi heist of 2026 so far. Someone’s got a new summer home in the Bahamas.

So, crypto’s security tab has hit $17 billion over the past decade, according to DefiLlama (via Cointelegraph). That’s 518 hacks, exploits, and “oopsie-daisies” since 2014, spanning everything from early exchange explosions to today’s fancy cross-chain shenanigans. And while the pace of these exploits has slowed since the wild days of 2021-2022, the damage is still piling up like dirty laundry after a bachelor party.

A decade of $17b in crypto losses

But here’s the kicker: the nature of these losses is evolving. Remember when DeFi hacks were all about smart contract bugs and flash-loan shenanigans? Well, those days are as quaint as dial-up internet. Now, attackers are going after the softer targets-private keys, signing infrastructure, and your grandma’s email account. Security firms predict 2026 will bring even more sophisticated phishing scams and AI-assisted trickery, because apparently, even tech-savvy folks can’t resist clicking on “Free Crypto! Click Here!”

From smart contracts to bridges and wallets

Bridges, those supposed marvels of cross-chain connectivity, have turned into the crypto equivalent of a piñata at a hacker convention. DefiLlama’s data shows bridges account for nearly $3 billion of the $11.8 billion in total hacked value. Highlights include the Ronin, Wormhole, and Multichain exploits, which set the bar for “how not to build a bridge.” The latest victim? Kelp DAO’s rsETH bridge, which lost $290 million after an attacker forged a cross-chain message. Turns out, LayerZero’s single-validator setup was about as secure as leaving your front door unlocked with a sign that says, “Free Money Inside.”

The rsETH tokens, worth about $290-$293 million (or 18% of the total supply), were promptly siphoned off to an attacker-controlled address. Kelp DAO had to hit the emergency brakes, pause the bridge, and play damage control with exchanges and protocols. Meanwhile, everyone’s pointing fingers at LayerZero’s default setup, which was basically a “Hack Me” sign in neon lights.

But it’s not just the big exploits making waves. Everyday credential thefts are adding up faster than a politician’s promises. In Q1 2026 alone, hackers stole $168.6 million from 34 DeFi protocols, with the biggest heist-a $40 million Step Finance theft-traced back to a compromised private key. So, while smart contract security is getting tougher, attackers are just moving upstream, targeting the humans and tools that connect wallets to protocols. Because, let’s face it, humans are the weakest link.

The moral of the story? Audits and formal verification are great, but they’re about as useful as a screen door on a submarine if you’re not also using hardware keys, multi-sig setups, and practicing phishing hygiene like your life depends on it (because, in crypto, it kind of does). After all, one compromised credential is all it takes to turn your DeFi dreams into a DefiLlama nightmare.

Read More

2026-04-22 00:00